@ccoalm/ccl-skills 0.1.0

package/dist/assets/marketplace/plugins/ccl-skills/skills/testing-strategy/scripts/lang-basics-go-check.go

@@ -0,0 +1,198 @@
+// lang-basics-go-check — DETERMINISTIC check for LB-2 (Go ctx propagation), via go/ast.
+//
+// It flags calls to context.Background() / context.TODO() inside functions other than
+// main / init. Outside those entry/bootstrap points, fabricating a fresh root context is the
+// common shape of "I dropped the caller's ctx instead of propagating it" — losing
+// cancellation, deadline, and trace propagation.
+//
+// It resolves the local name bound to the "context" package per file, so an aliased import
+// (`import ctx "context"`) and a dot-import (`. "context"`) are both handled, not evaded.
+//
+// This is a deterministic PROXY, not a full "exported IO function missing ctx param" check
+// (that needs go/types to know which calls are I/O). A clean run does NOT prove every function
+// propagates ctx correctly. Accepted residuals (fixing them would false-positive on legit
+// usage): a closure/goroutine INSIDE main/init that calls context.Background() is not flagged
+// (often a legit background worker rooted at startup); a helper that returns
+// context.Background() and is called elsewhere is not traced; a local identifier shadowing the
+// context alias / dot-imported Background could in principle false-positive (rare).
+//
+// Scope: pass service / handler / repository / client Go files or directories. *_test.go is
+// skipped (directory scan AND explicit file args); vendor/.git/testdata/node_modules dirs are
+// skipped.
+//
+// INVOCATION: scan DIRECTORIES with `go run` — `go run lang-basics-go-check.go ./internal/svc`.
+// `go run` consumes trailing `.go` FILE args as additional package sources, so to scan
+// individual files build a binary first:
+//
+//	go build -o /tmp/lbgo lang-basics-go-check.go && /tmp/lbgo a.go b.go
+//
+// Exit: 0 no finding; 1 finding(s); 2 setup/inconclusive (missing path, non-.go file, dir with
+// no non-test .go, no non-test file in scope, walk error, or a parse error — NEVER clean).
+package main
+
+import (
+	"fmt"
+	"go/ast"
+	"go/parser"
+	"go/token"
+	"os"
+	"path/filepath"
+	"strconv"
+	"strings"
+)
+
+func setupErr(msg string) {
+	fmt.Fprintf(os.Stderr, "lang-basics-go: %s — inconclusive\n", msg)
+	os.Exit(2)
+}
+
+// Exempt by NAME: main / init. (A `func main` declared in a non-main package is exempted too —
+// a documented name-based carve-out; such code is unusual and not worth a package-name check.)
+// Test*/Benchmark*/Example*/Fuzz* are NOT exempted: _test.go files are skipped wholesale at
+// collection, and a production function merely NAMED TestX must still be scanned.
+func isEntryFunc(name string) bool {
+	return name == "main" || name == "init"
+}
+
+func skipDir(name string) bool {
+	switch name {
+	case "vendor", ".git", "testdata", "node_modules":
+		return true
+	}
+	return false
+}
+
+func collect(paths []string) []string {
+	var files []string
+	for _, p := range paths {
+		info, err := os.Stat(p)
+		if err != nil {
+			setupErr("path not found: " + p)
+		}
+		if info.IsDir() {
+			n := 0
+			werr := filepath.Walk(p, func(path string, fi os.FileInfo, e error) error {
+				if e != nil {
+					return e
+				}
+				if fi.IsDir() {
+					if skipDir(fi.Name()) {
+						return filepath.SkipDir
+					}
+					return nil
+				}
+				if strings.HasSuffix(path, ".go") && !strings.HasSuffix(path, "_test.go") {
+					files = append(files, path)
+					n++
+				}
+				return nil
+			})
+			if werr != nil {
+				setupErr("walk error under " + p + ": " + werr.Error())
+			}
+			if n == 0 {
+				setupErr("no non-test .go files under directory: " + p)
+			}
+		} else {
+			if !strings.HasSuffix(p, ".go") {
+				setupErr("not a .go file: " + p)
+			}
+			if strings.HasSuffix(p, "_test.go") {
+				continue
+			}
+			files = append(files, p)
+		}
+	}
+	if len(files) == 0 {
+		setupErr("no non-test .go files in scope")
+	}
+	return files
+}
+
+// contextNames returns the local identifiers that refer to the "context" package in this file,
+// plus whether it was dot-imported.
+func contextNames(node *ast.File) (map[string]bool, bool) {
+	names := map[string]bool{}
+	dot := false
+	for _, imp := range node.Imports {
+		// Unquote handles both interpreted ("context") and raw (`context`) import-path strings.
+		path, err := strconv.Unquote(imp.Path.Value)
+		if err != nil || path != "context" {
+			continue
+		}
+		switch {
+		case imp.Name == nil:
+			names["context"] = true
+		case imp.Name.Name == ".":
+			dot = true
+		case imp.Name.Name != "_":
+			names[imp.Name.Name] = true
+		}
+	}
+	return names, dot
+}
+
+func main() {
+	args := os.Args[1:]
+	if len(args) == 0 {
+		fmt.Fprintln(os.Stderr, "usage: go build -o /tmp/lbgo lang-basics-go-check.go && /tmp/lbgo <path> [...]  (or: go run lang-basics-go-check.go <DIR>)")
+		os.Exit(2)
+	}
+	files := collect(args)
+	fset := token.NewFileSet()
+	hits := 0
+	for _, f := range files {
+		node, err := parser.ParseFile(fset, f, nil, 0)
+		if err != nil {
+			setupErr(fmt.Sprintf("parse error %s: %v", f, err))
+		}
+		ctxNames, dot := contextNames(node)
+		if len(ctxNames) == 0 && !dot {
+			continue // file does not import context; it cannot call context.Background/TODO
+		}
+		flag := func(call *ast.CallExpr, where string) {
+			label := ""
+			switch fe := call.Fun.(type) {
+			case *ast.SelectorExpr:
+				if pkg, ok := fe.X.(*ast.Ident); ok && ctxNames[pkg.Name] &&
+					(fe.Sel.Name == "Background" || fe.Sel.Name == "TODO") {
+					label = "context." + fe.Sel.Name
+				}
+			case *ast.Ident:
+				if dot && (fe.Name == "Background" || fe.Name == "TODO") {
+					label = "context." + fe.Name + " (dot-import)"
+				}
+			}
+			if label != "" {
+				pos := fset.Position(call.Pos())
+				fmt.Printf("lang-basics-go smell: %s:%d: %s() in %s — propagate the caller's ctx, do not fabricate a root ctx\n",
+					f, pos.Line, label, where)
+				hits = 1
+			}
+		}
+		scan := func(root ast.Node, where string) {
+			ast.Inspect(root, func(m ast.Node) bool {
+				if call, ok := m.(*ast.CallExpr); ok {
+					flag(call, where)
+				}
+				return true
+			})
+		}
+		// Scan non-entry function bodies AND package-level declarations (var/const
+		// initializers have no enclosing function — `var bg = context.Background()`).
+		// main/init bodies are skipped (accepted residual: a closure there is often a legit
+		// background worker).
+		for _, decl := range node.Decls {
+			switch d := decl.(type) {
+			case *ast.FuncDecl:
+				if d.Body == nil || isEntryFunc(d.Name.Name) {
+					continue
+				}
+				scan(d.Body, d.Name.Name)
+			case *ast.GenDecl:
+				scan(d, "<package-level>")
+			}
+		}
+	}
+	os.Exit(hits)
+}

package/dist/assets/marketplace/plugins/ccl-skills/skills/testing-strategy/scripts/lang-basics-go-check.test.sh

@@ -0,0 +1,109 @@
+#!/usr/bin/env bash
+# Test harness for lang-basics-go-check.go — builds the checker, then proves it flags
+# context.Background()/TODO() outside entry funcs, exempts ONLY main/init (a production func
+# named Test* is NOT exempt), resolves alias/dot imports, skips _test.go, and is inconclusive
+# (not clean) on bad scope.
+# Run: bash lang-basics-go-check.test.sh   (honors $TMPDIR; needs the Go toolchain)
+set -euo pipefail
+
+here="$(cd "$(dirname "$0")" && pwd)"
+src="$here/lang-basics-go-check.go"
+command -v go >/dev/null 2>&1 || { echo "go toolchain required" >&2; exit 2; }
+base="${TMPDIR:-/tmp}"
+tmp="$(mktemp -d "${base%/}/lbgo.XXXXXX")"
+trap 'rm -rf "$tmp"' EXIT
+
+bin="$tmp/lbgo"
+go build -o "$bin" "$src"
+
+pass=0 fail=0
+assert_hit() { # <desc> <expect-substr> <path...>
+  local desc="$1" want="$2"; shift 2
+  set +e; local out rc; out="$("$bin" "$@" 2>/dev/null)"; rc=$?; set -e
+  if [ "$rc" = 1 ] && printf '%s' "$out" | grep -qF "$want"; then
+    pass=$((pass+1)); echo "ok   - $desc"
+  else
+    fail=$((fail+1)); echo "FAIL - $desc (rc=$rc, want '$want', out='$out')"
+  fi
+}
+assert_exit() { # <desc> <expected-exit> <path...>
+  local desc="$1" want="$2"; shift 2
+  set +e; "$bin" "$@" >/dev/null 2>&1; local rc=$?; set -e
+  if [ "$rc" = "$want" ]; then pass=$((pass+1)); echo "ok   - $desc"; else fail=$((fail+1)); echo "FAIL - $desc (want exit $want, got $rc)"; fi
+}
+
+mkdir -p "$tmp/svc" "$tmp/tonly"
+cat > "$tmp/svc/positive.go" <<'EOF'
+package svc
+import "context"
+func Handle() error { ctx := context.Background(); return do(ctx) }
+func Repo() { _ = context.TODO() }
+EOF
+cat > "$tmp/svc/clean.go" <<'EOF'
+package svc
+import "context"
+func Handle(ctx context.Context) error { return do(ctx) }
+func main() { _ = context.Background() }
+func init() { _ = context.TODO() }
+EOF
+cat > "$tmp/tonly/x_test.go" <<'EOF'
+package svc
+import "context"
+func TestX() { _ = context.Background() }
+EOF
+mkdir -p "$tmp/extra"
+cat > "$tmp/extra/alias.go" <<'EOF'
+package svc
+import ctx "context"
+func Fetch() { _ = ctx.Background() }
+EOF
+cat > "$tmp/extra/dot.go" <<'EOF'
+package svc2
+import . "context"
+func Fetch2() { _ = Background() }
+EOF
+cat > "$tmp/extra/prodtest.go" <<'EOF'
+package svc3
+import "context"
+func TestConnection() { _ = context.Background() }
+EOF
+cat > "$tmp/extra/pkglevel.go" <<'EOF'
+package svc4
+import "context"
+var bg = context.Background()
+EOF
+cat > "$tmp/extra/rawimport.go" <<'EOF'
+package svc5
+import `context`
+func Fetch5() { _ = context.Background() }
+EOF
+# vendor-skip regression: a Background() inside vendor/ must NOT be reported on a parent scan
+mkdir -p "$tmp/vend/vendor"
+cat > "$tmp/vend/svc.go" <<'EOF'
+package vend
+import "context"
+func Clean(ctx context.Context) { _ = ctx }
+EOF
+cat > "$tmp/vend/vendor/bad.go" <<'EOF'
+package vendored
+import "context"
+func Bad() { _ = context.Background() }
+EOF
+
+assert_hit  "Background()/TODO() in non-entry funcs flagged" "context.Background()" "$tmp/svc/positive.go"
+assert_hit  "aliased import (import ctx \"context\") caught"  "context.Background()" "$tmp/extra/alias.go"
+assert_hit  "dot-import Background() caught"                  "dot-import"           "$tmp/extra/dot.go"
+assert_hit  "production func named Test* NOT exempted"        "context.Background()" "$tmp/extra/prodtest.go"
+assert_hit  "package-level var = context.Background() caught"  "package-level"       "$tmp/extra/pkglevel.go"
+assert_hit  "raw-string import path (backticks) caught"       "context.Background()" "$tmp/extra/rawimport.go"
+assert_exit "vendor/ Background not reported on parent scan"  0   "$tmp/vend"
+assert_hit  "TODO() flagged too"                             "context.TODO()"       "$tmp/svc/positive.go"
+assert_exit "dir scan: positive present -> 1"          1    "$tmp/svc"
+assert_exit "clean (ctx param; main/init exempt) -> 0" 0    "$tmp/svc/clean.go"
+assert_exit "dir with only _test.go -> inconclusive 2" 2    "$tmp/tonly"
+assert_exit "explicit _test.go file arg -> (2)"        2    "$tmp/tonly/x_test.go"
+assert_exit "missing path -> setup (2)"                2    "$tmp/svc/nope.go"
+
+echo "----"
+echo "passed=$pass failed=$fail"
+[ "$fail" -eq 0 ]

package/dist/assets/marketplace/plugins/ccl-skills/skills/testing-strategy/scripts/test_mutation_backup_recipe.sh

@@ -0,0 +1,237 @@
+#!/usr/bin/env bash
+# Executable spec for the mutation backup/restore recipe in
+# references/run-killing-mutation-walk.md (Guarded Backup Recipe).
+#
+# The recipe is prose an agent follows by hand, so this file carries the steps
+# verbatim and asserts each property the prose promises. It exists because the
+# prose accumulated nineteen review rounds of real defects — symlinks, name
+# collisions, quoting, failed copies, cleanup ordering — and narrative scratch
+# checks proved them once without leaving anything that fails on regression.
+#
+# Every assertion here has a stated killing mutation in the deep self-audit
+# recorded alongside this change; changing the recipe's guarantees must turn a
+# case red.
+set -uo pipefail
+
+# Every case runs in `( cd "$t" || exit 1; ... )`. The `|| exit` is load-bearing:
+# without it a failed cd leaves the subshell running in the repository root, where
+# the fixture writes land — that is how an earlier run of this very file left six
+# stray files at the repo root and got them committed.
+
+# Counting is done by parsing markers off stdout, not by shared state: every case
+# runs in a subshell, and neither shell variables (invisible to the parent) nor a
+# temp tally directory (which earlier vanished mid-run and silently zeroed the
+# count while the suite still exited 0) survive that boundary reliably.
+check() { if [ "$2" = "$3" ]; then echo "PASS $1"; else echo "FAIL $1 (got '$2', want '$3')"; fi; }
+
+# Probe the stat dialect explicitly. A BSD-first `stat -f ... || stat -c ...` does
+# NOT fall back on GNU: there `-f` means --file-system and SUCCEEDS with unrelated
+# output, so the || branch never runs and the assertion compares garbage.
+if stat --version >/dev/null 2>&1; then
+  stat_mode() { stat -c '%a' "$1"; }; stat_mtime() { stat -c '%Y' "$1"; }
+else
+  stat_mode() { stat -f '%Lp' "$1"; }; stat_mtime() { stat -f '%m' "$1"; }
+fi
+have_git() { command -v git >/dev/null 2>&1; }
+
+# --- the recipe, verbatim -----------------------------------------------------
+# backup:  bak=$(mktemp -d); mkdir -p "$bak/$(dirname "$f")" && cp -a -- "$f" "$bak/$f" || exit
+# restore: cp -a -- "$bak/$f" "$f" || exit
+# cleanup: rm -rf "$bak"   ONLY after every restore succeeded
+# The rule promises the backup root sits OUTSIDE the worktree; mktemp honours
+# TMPDIR, so that promise has to be checked rather than assumed.
+backup_root_outside_worktree() { # backup_root_outside_worktree <bak>
+  # Compare against the working directory, not `git rev-parse`: a minimal CI
+  # image may have no git, and the original version treated that as "allow",
+  # silently disabling the check in exactly the environment it matters in.
+  local base bak
+  base=$(pwd -P) || return 1
+  bak=$(cd -- "$1" && pwd -P) || return 1
+  case "$bak/" in "$base"/*) return 1 ;; esac
+  return 0
+}
+
+backup_one() { # backup_one <bak> <repo-relative path>
+  backup_root_outside_worktree "$1" || return 1
+  # `--` on dirname too: a first component like -fixtures/ is a valid path but
+  # parses as an option without it.
+  mkdir -p "$1/$(dirname -- "$2")" && cp -a -- "$2" "$1/$2"
+}
+
+# The documented sequence: restore every target, and remove the backup root ONLY
+# when all of them succeeded — cleanup after a failed restore destroys the last
+# copy while the mutation is still live.
+restore_all_and_cleanup() { # restore_all_and_cleanup <bak> <path>...
+  local bak="$1"; shift
+  local rc=0 one
+  for one in "$@"; do restore_one "$bak" "$one" || rc=1; done
+  [ "$rc" -eq 0 ] && rm -rf "$bak"
+  return "$rc"
+}
+restore_one() { # restore_one <bak> <path>
+  cp -a -- "$1/$2" "$2"
+}
+
+new_repo() {
+  local d
+  d=$(mktemp -d)
+  git -C "$d" init -q
+  git -C "$d" config user.email t@example.invalid
+  git -C "$d" config user.name t
+  printf '%s' "$d"
+}
+
+all_cases() {
+  # 1. round trip restores content byte-for-byte
+  t=$(new_repo); bak=$(mktemp -d)
+  ( cd "$t" || exit 1; printf 'original\n' > a.txt
+    backup_one "$bak" a.txt
+    printf 'MUTATED\n' > a.txt
+    restore_one "$bak" a.txt
+    check "content round trip" "$(cat a.txt)" "original" )
+  rm -rf "$t" "$bak"
+
+  # 2. metadata survives. Mode alone does NOT discriminate `cp -a` from plain `cp`
+  #    here (a plain copy of a 755 file lands 755 after umask), so this asserts the
+  #    modification time, which a plain copy resets to now. Both are checked: the
+  #    mode assertion guards against an outright chmod, the mtime one is what fails
+  #    if someone drops `-a`.
+  t=$(new_repo); bak=$(mktemp -d)
+  ( cd "$t" || exit 1; printf 'x\n' > m.sh; chmod 755 m.sh; touch -t 202001011200 m.sh
+    want_mtime=$(stat_mtime m.sh)
+    backup_one "$bak" m.sh
+    printf 'MUTATED\n' > m.sh; chmod 600 m.sh
+    restore_one "$bak" m.sh
+    check "mode preserved" "$(stat_mode m.sh)" "755"
+    check "mtime preserved" "$(stat_mtime m.sh)" "$want_mtime" )
+  rm -rf "$t" "$bak"
+
+  # 3. same basename in different directories must not collide
+  t=$(new_repo); bak=$(mktemp -d)
+  ( cd "$t" || exit 1; mkdir -p src tests
+    printf 'SRC\n' > src/config.py; printf 'TESTS\n' > tests/config.py
+    backup_one "$bak" src/config.py; backup_one "$bak" tests/config.py
+    printf 'MUTATED\n' > src/config.py; printf 'MUTATED\n' > tests/config.py
+    restore_one "$bak" src/config.py; restore_one "$bak" tests/config.py
+    check "no collision (src)" "$(cat src/config.py)" "SRC"
+    check "no collision (tests)" "$(cat tests/config.py)" "TESTS" )
+  rm -rf "$t" "$bak"
+
+  # 4. paths with spaces and glob characters survive quoting
+  t=$(new_repo); bak=$(mktemp -d)
+  ( cd "$t" || exit 1; mkdir -p "tests/cases"
+    f='tests/cases/new behavior [v2].py'
+    printf 'spaced\n' > "$f"
+    backup_one "$bak" "$f"
+    printf 'MUTATED\n' > "$f"
+    restore_one "$bak" "$f"
+    check "quoted path round trip" "$(cat "$f")" "spaced" )
+  rm -rf "$t" "$bak"
+
+  # 6. git state is untouched: HEAD, status (including another line's staged
+  #    entry and an untracked file), and object count all unchanged
+  # Skipped where git is unavailable: a minimal CI image may not ship it, and a
+  # missing tool must be reported, not silently counted as a failure.
+  if have_git; then
+  t=$(new_repo); bak=$(mktemp -d)
+  ( cd "$t" || exit 1; printf 'base\n' > tracked.txt; git add -A >/dev/null; git commit -qm init
+    printf 'uncommitted\n' > tracked.txt
+    printf 'staged elsewhere\n' > other.txt; git add other.txt
+    printf 'untracked\n' > loose.txt
+    before_status=$(git status --porcelain | sort); before_head=$(git rev-parse HEAD)
+    # Inventory the object database itself: rev-list --all --count only counts
+    # reachable commits, so a stray blob or a create-then-reset commit leaves
+    # objects on disk while that number is unchanged.
+    before_objects=$(find .git/objects -type f | sort)
+    backup_one "$bak" tracked.txt
+    printf 'MUTATED\n' > tracked.txt
+    restore_one "$bak" tracked.txt
+    check "git status untouched" "$(git status --porcelain | sort)" "$before_status"
+    check "git HEAD untouched" "$(git rev-parse HEAD)" "$before_head"
+    check "git objects untouched" "$(find .git/objects -type f | sort)" "$before_objects" )
+  rm -rf "$t" "$bak"
+
+  else
+    echo 'SKIP git-state case (git unavailable)'
+  fi
+
+  # 7. backup failure is detectable BEFORE mutating (fail-fast precondition)
+  t=$(new_repo); bak=$(mktemp -d)
+  ( cd "$t" || exit 1
+    if backup_one "$bak" does/not/exist.txt 2>/dev/null; then
+      check "missing source backup fails" "succeeded" "failed"
+    else
+      check "missing source backup fails" "failed" "failed"
+    fi )
+  rm -rf "$t" "$bak"
+
+  # 8. restore failure is detectable, so cleanup can be gated on it
+  t=$(new_repo); bak=$(mktemp -d)
+  ( cd "$t" || exit 1; printf 'x\n' > r.txt
+    backup_one "$bak" r.txt
+    rm -rf "$bak"                        # simulate a lost/failed backup
+    if restore_one "$bak" r.txt 2>/dev/null; then
+      check "restore failure detected" "succeeded" "failed"
+    else
+      check "restore failure detected" "failed" "failed"
+    fi )
+  rm -rf "$t" "$bak"
+
+  # 10. cleanup is gated on restore success. Failure is injected by making the
+  #     target read-only, which makes cp fail (a read-only *directory* does not —
+  #     overwriting an existing file needs no directory write permission).
+  t=$(new_repo)
+  ( cd "$t" || exit 1; bak=$(mktemp -d)
+    mkdir sub; printf 'keep\n' > sub/k.txt; backup_one "$bak" sub/k.txt
+    # Permission-independent failure: replace the parent directory with a regular
+    # file, so the restore fails with ENOTDIR. A read-only target would not do —
+    # root can overwrite it, which would make this case fail on a root-run lane.
+    rm -rf sub; printf 'blocker\n' > sub
+    restore_all_and_cleanup "$bak" sub/k.txt 2>/dev/null \
+      && check "failed restore reported" succeeded failed || check "failed restore reported" failed failed
+    check "backup kept after failed restore" "$([ -d "$bak" ] && echo kept || echo deleted)" kept
+    rm -rf "$bak" )
+  rm -rf "$t"
+
+  # 11. the success path does remove the backup root
+  t=$(new_repo)
+  ( cd "$t" || exit 1; bak=$(mktemp -d)
+    printf 'ok\n' > g.txt; backup_one "$bak" g.txt
+    printf 'MUTATED\n' > g.txt
+    restore_all_and_cleanup "$bak" g.txt
+    check "restored content" "$(cat g.txt)" "ok"
+    check "backup removed on success" "$([ -d "$bak" ] && echo kept || echo deleted)" deleted )
+  rm -rf "$t"
+
+  # 12. a backup root inside the worktree is refused (TMPDIR pointing into the repo)
+  t=$(new_repo)
+  ( cd "$t" || exit 1; printf 'x\n' > in.txt
+    inside=$(mktemp -d "$t/inside.XXXXXX")
+    backup_one "$inside" in.txt 2>/dev/null \
+      && check "in-worktree backup root refused" accepted refused || check "in-worktree backup root refused" refused refused
+    outside=$(mktemp -d)
+    backup_one "$outside" in.txt 2>/dev/null \
+      && check "outside backup root accepted" accepted accepted || check "outside backup root accepted" refused accepted
+    rm -rf "$outside" )
+  rm -rf "$t"
+
+}
+
+out=$(all_cases 2>&1)
+printf '%s\n' "$out"
+pass=$(printf '%s\n' "$out" | grep -c '^PASS ')
+fail=$(printf '%s\n' "$out" | grep -c '^FAIL ')
+echo "mutation-backup-recipe: ${pass} passed, ${fail} failed"
+# Partial execution is a failure, not a pass. An empty-run check alone is not
+# enough: a case that aborts before its check (a failed cd, setup, or copy) emits
+# no marker, and the remaining PASS markers would still carry the suite green.
+# Pin the exact count — raise it deliberately when adding a case, which is the
+# point: the bump is where you confirm the new assertion actually ran.
+expected=17
+have_git || expected=$((expected - 3))
+total=$((pass + fail))
+if [ "$total" -ne "$expected" ]; then
+  echo "FAIL: expected $expected assertions, saw $total (a case aborted before asserting, or the count needs updating)" >&2
+  exit 1
+fi
+[ "$fail" -eq 0 ]